diff -u -N -r curl-7.31.0/docs/curl.1 curl-7.31.0-new/docs/curl.1 --- curl-7.31.0/docs/curl.1 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/docs/curl.1 2013-07-16 18:20:12.000000000 +0100 @@ -926,6 +926,25 @@ user name and password from the \fI-u\fP option aren't actually used. If this option is used several times, only the first one is used. + +.IP "--negotiate-gssapi-service " +The default service name for a HTTP server is HTTP/host-fqdn. This option +allows you to change it. + +Examples: --negotiate \fI--negotiate-gssapi-service\fP KHTTP would use +KHTTP/host --negotiate \fI--negotiate-gssapi-service (replaces hardcoded if(neg_ctx->gss))\fP +HTTP/host-int2 would use HTTP/host-int2 for cases where the host does +not match the principal name. (Added in 7.x.y). + +.IP "--proxy-negotiate-gssapi-service " +The default service name for a HTTP proxy server is HTTP/proxy-fqdn. This option +allows you to change it. + +Examples: --proxy-negotiate \fI--proxy-negotiate-gssapi-service\fP KHTTP would use +KHTTP/proxyhost --negotiate \fI--proxy-negotiate-gssapi-service\fP +HTTP/proxyhost-int2 would use HTTP/proxyhost-int2 for cases where the proxyhost does +not match the principal name. (Added in 7.x.y). + .IP "--no-keepalive" Disables the use of keepalive messages on the TCP connection, as by default curl enables them. diff -u -N -r curl-7.31.0/include/curl/curl.h curl-7.31.0-new/include/curl/curl.h --- curl-7.31.0/include/curl/curl.h 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/include/curl/curl.h 2013-07-16 17:41:09.000000000 +0100 @@ -1533,6 +1533,12 @@ /* Enable/disable SASL initial response */ CINIT(SASL_IR, LONG, 218), + /* Socks Service */ + CINIT(NEGOTIATE_GSSAPI_SERVICE, OBJECTPOINT, 219), + + /* Socks Service */ + CINIT(PROXY_NEGOTIATE_GSSAPI_SERVICE, OBJECTPOINT, 220), + CURLOPT_LASTENTRY /* the last unused */ } CURLoption; diff -u -N -r curl-7.31.0/include/curl/typecheck-gcc.h curl-7.31.0-new/include/curl/typecheck-gcc.h --- curl-7.31.0/include/curl/typecheck-gcc.h 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/include/curl/typecheck-gcc.h 2013-07-16 17:41:09.000000000 +0100 @@ -259,6 +259,8 @@ (option) == CURLOPT_CRLFILE || \ (option) == CURLOPT_ISSUERCERT || \ (option) == CURLOPT_SOCKS5_GSSAPI_SERVICE || \ + (option) == CURLOPT_NEGOTIATE_GSSAPI_SERVICE || \ + (option) == CURLOPT_PROXY_NEGOTIATE_GSSAPI_SERVICE || \ (option) == CURLOPT_SSH_KNOWNHOSTS || \ (option) == CURLOPT_MAIL_FROM || \ (option) == CURLOPT_RTSP_SESSION_ID || \ diff -u -N -r curl-7.31.0/lib/http_negotiate.c curl-7.31.0-new/lib/http_negotiate.c --- curl-7.31.0/lib/http_negotiate.c 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/lib/http_negotiate.c 2013-07-16 18:18:18.000000000 +0100 @@ -61,12 +61,13 @@ static int get_gss_name(struct connectdata *conn, bool proxy, gss_name_t *server) { - struct negotiatedata *neg_ctx = proxy?&conn->data->state.proxyneg: - &conn->data->state.negotiate; OM_uint32 major_status, minor_status; gss_buffer_desc token = GSS_C_EMPTY_BUFFER; char name[2048]; const char* service; + char *serviceptr = proxy? + conn->data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE]: + conn->data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE]; /* GSSAPI implementation by Globus (known as GSI) requires the name to be of form "/" instead of @ (ie. slash instead @@ -75,25 +76,36 @@ /* IIS uses the @ form but uses 'http' as the service name */ - if(neg_ctx->gss) - service = "KHTTP"; - else - service = "HTTP"; + if(strchr(serviceptr,'/')) { + token.value = malloc(strlen(serviceptr)); + if(!token.value) + return EMSGSIZE; + token.length = strlen(serviceptr); + memcpy(token.value, serviceptr, token.length); + major_status = gss_import_name(&minor_status, + &token, + (gss_OID) GSS_C_NULL_OID, + server); + + } + else { + service = serviceptr; - token.length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name : + token.length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name : conn->host.name) + 1; - if(token.length + 1 > sizeof(name)) - return EMSGSIZE; + if(token.length + 1 > sizeof(name)) + return EMSGSIZE; - snprintf(name, sizeof(name), "%s@%s", service, proxy ? conn->proxy.name : - conn->host.name); - - token.value = (void *) name; - major_status = gss_import_name(&minor_status, - &token, - GSS_C_NT_HOSTBASED_SERVICE, - server); + snprintf(name, sizeof(name), "%s@%s", service, proxy ? conn->proxy.name : + conn->host.name); + token.value = (void *) name; + major_status = gss_import_name(&minor_status, + &token, + GSS_C_NT_HOSTBASED_SERVICE, + server); + } + infof(conn->data,"Import Service Name %.*s\n",token.length,token.value); return GSS_ERROR(major_status) ? -1 : 0; } diff -u -N -r curl-7.31.0/lib/http_negotiate_sspi.c curl-7.31.0-new/lib/http_negotiate_sspi.c --- curl-7.31.0/lib/http_negotiate_sspi.c 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/lib/http_negotiate_sspi.c 2013-07-16 18:10:48.000000000 +0100 @@ -45,8 +45,10 @@ get_gss_name(struct connectdata *conn, bool proxy, struct negotiatedata *neg_ctx) { - const char* service; size_t length; + char *serviceptr = proxy? + conn->data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE]: + conn->data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE]; if(proxy && !conn->proxy.name) /* proxy auth requested but no given proxy name, error out! */ @@ -61,19 +63,25 @@ and SSPI then generates an NTLM token. When using / a Kerberos token is generated. */ - if(neg_ctx->gss) - service = "KHTTP"; - else - service = "HTTP"; + if(strchr(serviceptr,'/')) { + length = strlen(serviceptr)+1; - length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name : - conn->host.name) + 1; - if(length + 1 > sizeof(neg_ctx->server_name)) - return EMSGSIZE; + if(length + 1 > sizeof(neg_ctx->server_name)) + return EMSGSIZE; - snprintf(neg_ctx->server_name, sizeof(neg_ctx->server_name), "%s/%s", - service, proxy ? conn->proxy.name : conn->host.name); + snprintf(neg_ctx->server_name, sizeof(neg_ctx->server_name), "%s", + serviceptr); + } + else { + length = strlen(serviceptr) + 1 + strlen(proxy ? conn->proxy.name : + conn->host.name) + 1; + if(length + 1 > sizeof(neg_ctx->server_name)) + return EMSGSIZE; + snprintf(neg_ctx->server_name, sizeof(neg_ctx->server_name), "%s/%s", + serviceptr, proxy ? conn->proxy.name : conn->host.name); + } + infof(conn->data,"Import Service Name %.*s\n",length,neg_ctx->server_name); return 0; } diff -u -N -r curl-7.31.0/lib/url.c curl-7.31.0-new/lib/url.c --- curl-7.31.0/lib/url.c 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/lib/url.c 2013-07-16 17:55:59.000000000 +0100 @@ -541,6 +541,17 @@ (char *) CURL_DEFAULT_SOCKS5_GSSAPI_SERVICE); if(res != CURLE_OK) return res; + + res = setstropt(&set->str[STRING_NEGOTIATE_GSSAPI_SERVICE], + (char *) CURL_DEFAULT_NEGOTIATE_GSSAPI_SERVICE); + if(res != CURLE_OK) + return res; + + res = setstropt(&set->str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE], + (char *) CURL_DEFAULT_PROXY_NEGOTIATE_GSSAPI_SERVICE); + if(res != CURLE_OK) + return res; + #endif /* This is our preferred CA cert bundle/path since install time */ @@ -1383,6 +1394,22 @@ */ data->set.socks5_gssapi_nec = (0 != va_arg(param, long))?TRUE:FALSE; break; + + case CURLOPT_NEGOTIATE_GSSAPI_SERVICE: + /* + * Set gssapi service name + */ + result = setstropt(&data->set.str[STRING_NEGOTIATE_GSSAPI_SERVICE], + va_arg(param, char *)); + break; + + case CURLOPT_PROXY_NEGOTIATE_GSSAPI_SERVICE: + /* + * Set gssapi service name + */ + result = setstropt(&data->set.str[STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE], + va_arg(param, char *)); + break; #endif case CURLOPT_WRITEHEADER: diff -u -N -r curl-7.31.0/lib/urldata.h curl-7.31.0-new/lib/urldata.h --- curl-7.31.0/lib/urldata.h 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/lib/urldata.h 2013-07-16 17:41:09.000000000 +0100 @@ -1370,6 +1370,8 @@ #endif #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) STRING_SOCKS5_GSSAPI_SERVICE, /* GSSAPI service name */ + STRING_NEGOTIATE_GSSAPI_SERVICE, /* GSSAPI service name */ + STRING_PROXY_NEGOTIATE_GSSAPI_SERVICE, /* GSSAPI service name */ #endif STRING_MAIL_FROM, STRING_MAIL_AUTH, diff -u -N -r curl-7.31.0/lib/url.h curl-7.31.0-new/lib/url.h --- curl-7.31.0/lib/url.h 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/lib/url.h 2013-07-16 18:12:29.000000000 +0100 @@ -73,6 +73,11 @@ #define CURL_DEFAULT_PROXY_PORT 1080 /* default proxy port unless specified */ #define CURL_DEFAULT_SOCKS5_GSSAPI_SERVICE "rcmd" /* default socks5 gssapi service */ +#define CURL_DEFAULT_NEGOTIATE_GSSAPI_SERVICE "HTTP" /* default negotiate + gssapi service */ +#define CURL_DEFAULT_PROXY_NEGOTIATE_GSSAPI_SERVICE "HTTP" /* default proxy + negotiate gssapi + service */ CURLcode Curl_connected_proxy(struct connectdata *conn); diff -u -N -r curl-7.31.0/src/tool_cfgable.c curl-7.31.0-new/src/tool_cfgable.c --- curl-7.31.0/src/tool_cfgable.c 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/src/tool_cfgable.c 2013-07-16 17:41:09.000000000 +0100 @@ -119,6 +119,8 @@ Curl_safefree(config->socksproxy); Curl_safefree(config->socks5_gssapi_service); + Curl_safefree(config->negotiate_gssapi_service); + Curl_safefree(config->proxy_negotiate_gssapi_service); Curl_safefree(config->ftp_account); Curl_safefree(config->ftp_alternative_to_user); diff -u -N -r curl-7.31.0/src/tool_cfgable.h curl-7.31.0-new/src/tool_cfgable.h --- curl-7.31.0/src/tool_cfgable.h 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/src/tool_cfgable.h 2013-07-16 17:41:09.000000000 +0100 @@ -171,6 +171,10 @@ int socksver; /* set to CURLPROXY_SOCKS* define */ char *socks5_gssapi_service; /* set service name for gssapi principal * default rcmd */ + char *negotiate_gssapi_service; /* set service name for gssapi principal + * default HTTP */ + char *proxy_negotiate_gssapi_service; /* set service name for gssapi principal + * default HTTP */ int socks5_gssapi_nec ; /* The NEC reference server does not protect * the encryption type exchange */ diff -u -N -r curl-7.31.0/src/tool_getparam.c curl-7.31.0-new/src/tool_getparam.c --- curl-7.31.0/src/tool_getparam.c 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/src/tool_getparam.c 2013-07-16 17:41:09.000000000 +0100 @@ -174,6 +174,10 @@ {"$I", "post303", FALSE}, {"$J", "metalink", FALSE}, {"$K", "sasl-ir", FALSE}, +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + {"$L", "proxy-negotiate-gssapi-service", TRUE}, + {"$M", "negotiate-gssapi-service", TRUE}, +#endif {"0", "http1.0", FALSE}, {"1", "tlsv1", FALSE}, {"2", "sslv2", FALSE}, @@ -961,6 +965,14 @@ case 'K': /* --sasl-ir */ config->sasl_ir = TRUE; break; +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + case 'L': /* --proxy-negotiate-gssapi-service */ + GetStr(&config->proxy_negotiate_gssapi_service, nextarg); + break; + case 'M': /* --negotiate-gssapi-service */ + GetStr(&config->negotiate_gssapi_service, nextarg); + break; +#endif } break; case '#': /* --progress-bar */ diff -u -N -r curl-7.31.0/src/tool_help.c curl-7.31.0-new/src/tool_help.c --- curl-7.31.0/src/tool_help.c 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/src/tool_help.c 2013-07-16 17:41:09.000000000 +0100 @@ -127,6 +127,9 @@ " -m, --max-time SECONDS Maximum time allowed for the transfer", " --metalink Process given URLs as metalink XML file", " --negotiate Use HTTP Negotiate Authentication (H)", +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + " --negotiate-gssapi-service NAME HTTP service name for gssapi", +#endif " -n, --netrc Must read .netrc for user name and password", " --netrc-optional Use either .netrc or URL; overrides -n", " --netrc-file FILE Set up the netrc filename to use", @@ -152,6 +155,9 @@ " --proxy-basic Use Basic authentication on the proxy (H)", " --proxy-digest Use Digest authentication on the proxy (H)", " --proxy-negotiate Use Negotiate authentication on the proxy (H)", +#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI) + " --proxy-negotiate-gssapi-service NAME HTTP proxy service name for gssapi", +#endif " --proxy-ntlm Use NTLM authentication on the proxy (H)", " -U, --proxy-user USER[:PASSWORD] Proxy user and password", " --proxy1.0 HOST[:PORT] Use HTTP/1.0 proxy on given port", diff -u -N -r curl-7.31.0/src/tool_operate.c curl-7.31.0-new/src/tool_operate.c --- curl-7.31.0/src/tool_operate.c 2013-06-21 23:29:04.000000000 +0100 +++ curl-7.31.0-new/src/tool_operate.c 2013-07-16 17:41:09.000000000 +0100 @@ -1208,6 +1208,16 @@ if(config->socks5_gssapi_nec) my_setopt_str(curl, CURLOPT_SOCKS5_GSSAPI_NEC, config->socks5_gssapi_nec); + + /* new in curl 7.x.y */ + if(config->negotiate_gssapi_service) + my_setopt_str(curl, CURLOPT_NEGOTIATE_GSSAPI_SERVICE, + config->negotiate_gssapi_service); + + /* new in curl 7.x.y */ + if(config->proxy_negotiate_gssapi_service) + my_setopt_str(curl, CURLOPT_PROXY_NEGOTIATE_GSSAPI_SERVICE, + config->proxy_negotiate_gssapi_service); } #endif /* curl 7.13.0 */